CVE-2021-25631: libreoffice Incomplete List of Disallowed Inputs

Vulnerability summary

CVE-2021-25631 is a high (CVSS 9.3) Incomplete List of Disallowed Inputs vulnerability in libreoffice. EPSS estimates a 5.04% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-05-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented by manipulating the link so it doesn't match the denylist but results in ShellExecute attempting to launch an executable type.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.